What’s Vulnerable › Vulnerabilities

CVE-2026-98120: netfs: Fix subreq ref leak

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-25 · updated 2026-10-26
• Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix subreq ref leak Fix a subrequest ref leak in netfs_unbuffered_write() in the event that subreq->io_iter ends up zero length during preparation.

Affected products

• Linux kernel: from 6.18.17 before 6.18.53; from 6.19.7 before 7.0; from 7.0.1 before 7.2.7; 7.0, 7.0-rc3, 7.0-rc4, 7.0-rc5, 7.0-rc6, 7.0-rc7 (+2) — fixed in 6.18.53, 7.0, 7.2.7
• Linux kernel: from 6.18.17 before 6.18.53; from 6.19.7 before 6.20; 7.0 — fixed in 6.18.53, 6.20, 7.3

How to fix

Upgrade to a fixed version: Linux kernel 6.18.53, 7.0, 7.2.7; Linux kernel 6.18.53, 6.20, 7.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0a573f4283a965a5e8716f621aec404cb4575328
• https://git.kernel.org/stable/c/3c30087e27598d9d359763e8be9bd3017fe08348
• https://git.kernel.org/stable/c/ebefb12122d1319257ecac01c1a928f78007716a

Get alerted when CVE-2026-98120 or the next vulnerability affects your stack